Getting Data In

How can I install multiple instances of the universal forwarder?

pfabrizi
Path Finder

My team are the IS Security folks for the company. We are migrating to SPLUNK from McAfee Nitro and currently we only have a need to look at Windows security event logs. We have our business folks using their own deployment of SPLUNK and we don't want to piggy back or share the deployment as this now need to be managed by our operations team and slow down any upgrades we might want to do that business area wouldn't. For these reason we want our own deployment. I have tested running multiple instances on a device by installing, poking the registry to change the service name, zipping up the contents, exporting the registry key then play it back on another device. While this would work with old software deployment strategy it will not work with our new which is puppet.

I can install via puppet using the MSI and while I can deploy to a folder of my choosing the service is still installed as splunkuniversalforwader.

I am looking for suggestions on how I can implement this.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Theres no way to set the service name using the MSI installer, so the only way is the registry hack you've already figured out.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/InstallonWindowsviathecommandline

You can import registry files with puppet though:

https://stackoverflow.com/questions/39544548/silent-way-to-import-registry-file-via-puppet-module

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Theres no way to set the service name using the MSI installer, so the only way is the registry hack you've already figured out.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/InstallonWindowsviathecommandline

You can import registry files with puppet though:

https://stackoverflow.com/questions/39544548/silent-way-to-import-registry-file-via-puppet-module

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...